As almost any computer user is aware, malware is a constant threat to any computer connected to the Internet. Malware (a term credited as the concatenation of “malicious software”) refers to a program or file that is harmful. Thus, malware includes computer worms, viruses, Trojan horses, and spyware, as well as computer system attacks that misuse or abuse legitimate computer and/or network system features and services.
It used to be that most malware was directed at corrupting or harming a computer system. Erased or corrupted hard drives were the typical consequence of an infected computer system. Unfortunately, the purposes behind recent versions of malware include malicious intents that are much more nefarious than simply corrupting or disrupting the computer system. More particularly, malware is now used to steal personal information in order to perpetrate frauds and identity theft, to access bank accounts, and the like. Detecting the effects of a malware infection is now more difficult because, unlike earlier malware consequences, the object is not to shut down an infected computer, but rather leave it running so that more and more information can be illicitly harvested.
To combat malware, it is almost essential that a network connected computer use anti-virus software (which now would be more aptly called anti-malware software) to protect against infection. Additionally, many computer users also rely upon hardware and/or software firewalls in conjunction with anti-virus software, to protect the computer. Unfortunately, even behind the shields of anti-virus software and firewalls, some malware threats, especially new forms of malware, are successful in infecting computer systems. And, as those skilled in the art will appreciate, once malware has infected a computer system, the malware often uses the infected computer system to infect other computer systems.
A computer system's network services, i.e., those processes that form the communication channels to and from an external network, are a primary target of malware and are particularly vulnerable. In some instances, malware may coerce a network service to perform an action that permits other processes to further compromise the computer system. For example, an unprotected network service may be directed to open a communication port that allows a third party to access the computer system and, thereby, gain control of the computer system. A rogue application, delivered in an infected email, could successfully direct the network services to open the unsecured port. Unfortunately, once a network service is compromised, the computer is open to the malicious intent of the malware.
As mentioned above, it is not always possible to prevent a malware infection. However, even when a computer system is infected, it would be beneficial to contain the infection by preventing a network service from performing network actions that would compromise, or further compromise, the computer system. Indeed, it would be very useful if network services could be constrained to “good” network actions.